Splunk Search

statement optimization because the link is the same for more condition. I like to use or operator

w044f
New Member

how can i optimize this statement :

       <condition field="title">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
       </condition>

       <condition field="Site">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="response">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="last_checked">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="response_time">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="average">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="range">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="sparkline_response_time">
          <link>
            <![CDATA[/app/website_monitoring/status_history?form.title=$row.title$&earliest=$earliest$&latest=$latest$]]>
          </link>
        </condition>

        <condition field="Serveur">
           <link>
              <![CDATA[/app/website_monitoring/status_history?form.title=$row.Serveur$&earliest=$earliest$&latest=$latest$]]>
            </link>
        </condition>

        <condition field="packet_loss">
           <link>
              <![CDATA[/app/website_monitoring/status_history?form.title=$row.Serveur$&earliest=$earliest$&latest=$latest$]]>
            </link>
        </condition>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you omit the field="..." attribute then one condition will apply to all fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...